Sudo

The official version of Sudo (superuser do) allows system administrators to allow specific users to run some commands that can only be run with root privileges.

Introduction to Sudo software

Su do (su "do") allows system administrators to grant certain users (or user groups) the ability to run certain (or all) commands as root, while logging all commands and parameters. Sudo operates on a per-command basis, it is not a shell replacement.

Sudo software features

        The ability to limit the commands a user can run on each host.

Sudo does extensive logging for every command, providing a clear audit trail for who did what. When used with the system logging daemon syslogd, sudo can log all commands to a central host (as well as the local host). At CU, all administrators use sudo instead of the root shell to take advantage of this logging.

Sudo uses timestamp files to implement a "ticketing" system. When a user calls sudo and enters their password, they are granted a 5-minute ticket (this timeout is configurable at compile time). Each subsequent sudo command will update the ticket for 5 minutes. This avoids the problem of leaving a root shell where others can physically access your keyboard. There is also an easy way for users to delete their ticket files, which is useful for placing in a .logout file.

Sudo’s configuration file, the sudoers file, is set up in a way that the same sudoers file can be used on many computers. This allows centralized management while maintaining the flexibility to define user permissions on each host. See the sample sudoers file below for a real-life example.

Sudo installation instructions

Sudo uses the “configure” script to detect features and types on the system. In this version, "configure" takes a lot more options than before. Please read this document carefully before configuring and building sudo. You can also read the file INSTALL.configure which explains more information about the "configure" script.

sudo system requirements

To build sudo from a source distribution, you need a POSIX-compliant operating system (any modern version of BSD, Linux, or Unix will work), an ANSI/ISO C compiler that supports the "long long" type, variadic macros (a C99 feature ) and the ar, make, and ranlib utilities.

If you wish to modify the parser, then you will need flex version 2.5.2 or higher, bison or biak (sudo comes with a pre-generated parser). You must also use the --devel option or pass devel=1 to make.

Sudo FAQ

   Q) When I run configure, it says "The C compiler cannot create the executable file".

A) This usually means you either don't have a valid compiler. This may be due to a missing license or a compiler package that cannot be found. Check the config.log for clues as to why this is happening. On many systems, the compiler component is live in /usr/ccs/bin and may not be in the PATH environment variable.

Q) When I run configure, it says "sudo requires the 'ar' utility to build".

A) As part of the build process, sudo creates a containing object that is shared between different sudo executables.

On Unix systems, use the "ar" utility to perform this operation. This error indicates that "ar" is missing from the system. On Solaris systems, you may need to install the SUNWbtool package. On other systems "ar" may be included in the GNU binutils package.

Sudo change log

Sudo is once again ignoring failures to restore RLIMIT_core resource limits, as it did before 1.8.29. Linux containers do not allow RLIMIT_CORE to be set back to RLIM_INFINITY, which causes sudo to issue a warning if we set the limit to zero, even for root.